New York IT agency lost 17,000 devices, planned to destroy working ones, audit found

An audit published Friday by the New York state comptroller’s office found that the Office of Information Technology Services lost track of 17,887 devices, including desktops and laptops meant for state agencies, resulting in “overspending and government waste.”

The audit, covering March 2020 to August 2024, found the IT department failed to manage its technology inventory and safeguard the data stored on stockroom devices. It also discovered the department was preparing to destroy lightly used or new equipment worth half a million dollars.

“ITS does not have the necessary controls in place to accurately and completely account for all workstations and other hardware assets for which it is responsible,” the audit reads.

The audit uncovered “significant weaknesses” in the agency’s security over equipment and the information stored on its stockroom devices. The Office of Information Technology Services supports 108 agencies and manages 88 stockroom locations throughout the state, according to the auditor’s report.

The report found hardware located in stockrooms that was not reflected in the technology office’s records and devices listed in its records but not present in the stockrooms. The audit also noted that stockroom equipment was “inappropriately accessible” to employees of other agencies.

“We observed unsecured workstations and the unsecured storage of hard drives that potentially contain confidential data,” the audit states.

Auditors cited 36 pallets of laptops, keyboards, hard drives and monitors, left unattended in a shared storage area.

The comptroller’s office also found that ITS was prepared to destroy 924 lightly used or new computers worth between $530,000 to $660,000, despite the devices being in working condition. Auditors credited this to the agency’s complicated processes for reusing equipment.

“New, used, and lightly used equipment was, in the past, sometimes donated or sold at State auctions,” the report reads. “However, due to additional processes necessary to donate or sell workstation equipment, ITS currently elects to destroy all discarded equipment, even equipment in new or like-new condition.”

The comptroller’s office recommended ITS review its inventory records for accuracy, standardize its stockroom policies, implement asset tracking systems, conduct security sweeps and update its training materials.

“While we recognize there is always room for improvement, it’s important to note that ITS does have robust controls and security in place to fully protect its assets,” Scott Reif, ITS chief communications officer told StateScoop in an email.

Reif said the agency recently established an IT asset management team, which is responsible for tracking technology assets. The office also implemented a new asset management policy that requires regular device verification, designed to weed out unauthorized devices connected to the state network, as well as inactive devices that may have been lost or reassigned.   

“We take our responsibility to our client agencies and all New Yorkers very seriously, and will continue to improve and strengthen our processes to serve them better and more efficiently” Reif said.